I'm a member of a certain organization. This organization has an online store. The only thing required to access my account for the online store is my membership number. I'm required to give out my membership number in certain instances. I am the only that sees a problem with this?
That's almost as stupid as Oklahoma using SSNs as driver's license numbers.